| Index: src/objects.cc
|
| diff --git a/src/objects.cc b/src/objects.cc
|
| index 1eaea79c56358befd28d73956ff954ed232935ab..50c301111de115a883cbb68f0b718c85c40eb6de 100644
|
| --- a/src/objects.cc
|
| +++ b/src/objects.cc
|
| @@ -16798,8 +16798,15 @@ Handle<JSArrayBuffer> JSTypedArray::MaterializeArrayBuffer(
|
| fixed_typed_array->length(), typed_array->type(),
|
| static_cast<uint8_t*>(buffer->backing_store()));
|
|
|
| - buffer->set_weak_first_view(*typed_array);
|
| - DCHECK(typed_array->weak_next() == isolate->heap()->undefined_value());
|
| + Heap* heap = isolate->heap();
|
| + if (heap->InNewSpace(*typed_array)) {
|
| + DCHECK(typed_array->weak_next() == isolate->heap()->undefined_value());
|
| + typed_array->set_weak_next(heap->new_array_buffer_views_list());
|
| + heap->set_new_array_buffer_views_list(*typed_array);
|
| + } else {
|
| + buffer->set_weak_first_view(*typed_array);
|
| + DCHECK(typed_array->weak_next() == isolate->heap()->undefined_value());
|
| + }
|
| typed_array->set_buffer(*buffer);
|
| JSObject::SetMapAndElements(typed_array, new_map, new_elements);
|
|
|
|
|